Secfense has been named the 2026 ISSA Organization of the Year by the Information Systems Security Association.

The award recognizes organizations whose work contributes to cybersecurity practice, professional standards and the security community. Previous recipients include CISA, the Mandiant Threat Research Team, The Nmap Project, OWASP and Grand Canyon University.

For Secfense, the award recognizes work in 3 areas: bringing phishing-resistant authentication to existing applications, supporting passkey deployments for more than 1 million enterprise users and sharing practical knowledge with the cybersecurity community.

Phishing-resistant authentication for existing applications

Many organizations want to introduce FIDO2 authentication or passkeys across their workforce. The technical and organizational cost of changing every application often slows down those projects.

Secfense User Access Security Broker lets organizations add FIDO2-based authentication to existing applications without changing their source code. It works with the current identity and application environment, allowing security teams to introduce a consistent authentication policy across modern and legacy systems.

This approach has helped Secfense customers extend phishing-resistant authentication to applications that would otherwise require separate development projects.

The result is a practical path from passwords and weaker MFA methods to cryptographic authentication that resists credential phishing and account takeover.

Passkeys for more than 1 million enterprise users

Secfense technology now supports passkey access for more than 1 million enterprise users.

Deployments at this scale require more than browser support for a new authentication method. Organizations need to manage enrollment, account recovery, device changes, application compatibility and access policies across a mixed IT environment.

Secfense lets them introduce passkeys while retaining their current applications and identity systems. This reduces the amount of application-level work required and gives security teams central control over the rollout.

The award recognizes the practical effect of these deployments: phishing-resistant authentication reaching people who use business applications every day.

Work with the security community

Secfense also works closely with ISSA Polska and other industry organizations on education around identity security, FIDO2, passkeys and modern access threats.

This includes technical sessions, webinars, industry discussions and knowledge-sharing initiatives aimed at security practitioners. The company has also contributed to the FIDO Alliance community and joined the Passkey Pledge, supporting wider adoption of passwordless authentication.

The community element is part of the ISSA Organization of the Year criteria. ISSA considers an organization’s sustained contribution to its members, the profession and the future direction of information security.

Recognition from the international cybersecurity community

ISSA is an international association for cybersecurity professionals, with chapters and members across the world. Its annual awards recognize individuals, chapters and organizations whose work contributed to cybersecurity during the previous year.

The 2026 ISSA Awards cover professional achievement, public service, volunteer work and organizational contributions to cybersecurity.

Secfense will receive the award during the ISSA International Awards Gala on September 10, 2026, in Colorado Springs, Colorado. The event will bring together security professionals, chapter representatives and this year’s award recipients.

“We’re proud that ISSA recognized both the technology we’ve built and the work required to make phishing-resistant authentication available at enterprise scale,” said Marcin Szary, CEO of Secfense. “More than 1 million users can already access business applications with passkeys through Secfense. This award belongs to our team, customers, partners and everyone who has shared their experience with us along the way.”

The award also sets a clear direction for our next stage of work: giving organizations practical control over who can reach their applications and access services, before a login page or authentication prompt becomes available.

That work now includes Secfense Ghost, which restricts access to internet-facing services such as VPNs, administrative panels and application gateways. Verified users receive a temporary route to the protected service. Unsolicited traffic receives no handshake, banner or product fingerprint.

Secfense will continue working on both sides of the access problem: strong authentication for verified users and tighter control over who can reach critical services in the first place.